Privacy policy
Last updated: 30 October 2026
Mennu is a digital menu and table ordering service operated by DevCode Ltd, registered in England & Wales, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. This policy explains what personal data we process, why, and the choices you have. We are the data controller for account data. For data about your guests, you (the venue) are the controller and we act as your processor.
What we collect
Account data: your email address, name, password (stored only as a salted hash) or Google account ID if you sign in with Google, and your language preference.
Venue content: your venue name, address, contact details, menu, photos, opening hours and settings.
Billing data: subscription status and plan. Card details are entered on Stripe and never reach our servers.
Guest data: when guests use a menu we store orders, waiter and bill requests, ratings and optional comments together with the table number. Guests do not create accounts; a random device token links a guest to their own recent orders.
Usage data: anonymous menu views and dish views (with a random visitor token, language and table) to power your statistics, plus technical logs (IP address, browser) kept for security for a short time.
Why we use it
To provide the service you sign up for (contract), to secure it and prevent abuse (legitimate interest), to send service emails such as password resets and trial reminders (contract), and to meet legal and tax obligations. We do not sell personal data and we do not show ads.
Who we share it with
We use carefully chosen processors: Hetzner (hosting, Germany), Cloudflare (network and security), Stripe (payments), Zoho ZeptoMail (transactional email), Anthropic (AI translation and menu import — only menu text and images you choose to process are sent) and Google (optional sign-in). Some providers may process data outside the UK/EEA under standard contractual clauses or equivalent safeguards.
How long we keep it
Account and venue data are kept while your account is active and deleted within 30 days after you ask us to close it. Guest orders and requests are kept for your order history; usage statistics are deleted after about 13 months. Billing records are kept as long as tax law requires.
Cookies
We use only necessary cookies: a session cookie to keep you signed in and a language cookie. Guest menus store small preferences (language, cart, recent orders) in the browser's local storage. We use no advertising or third-party tracking cookies.
Your rights
Under UK GDPR and EU GDPR you can ask for access to, correction or deletion of your data, object to or restrict processing, and receive your data in a portable format. Write to [email protected]. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. Guests should contact the venue first; we will help the venue answer.
Contact
DevCode Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Email: [email protected].